Net-Worm.Win32.Sasser.c

Technical Details

This worm spreads via the Internet exploiting a vulnerability in Microsoft Windows LSASS. The vulnerability is described in Microsoft Security Bulletin MS04-11

The patch for this vulnerability was released on 13th April 2004. The first example of the worm was detected 30th April 2004.

The worm works in a way very similar to Lovesan, which appeared in August 2003. Lovesan exploited a similar vulnerability in Windows RPC DCOM service.

Machines running Windows 2000/XP/2003 Server are vulnerable to infection. The worm can function in other versions of Windows, but is incapable of using the vulnerability to penetrate machines from the outside.

The worm is written in C/C++ using Visual C compiler. It is approximately 16KB in size, and packed using PECompact 2.

Signs of infection:

• a file named skynetave.exe in the Windows directory
• an error message about LSASS service failure which will then lead to the system rebooting

How Sasser.c differs from Sasser.b

The worm file has a different name: skynetave.exe instead of avserve.exe. Correspondingly, the system registry entry will be different.

The mutex has also been changed, to SkynetSasserVersionWithPingFast.

When attacking a remote machine the worm launches a remote shell on port TCP 9995.

Before sending the exploit to the victim machine, the worm sends a preliminary ICMP request.